A user creates some contents such as document, image, voice-related or others using an application program installed on a client Personal Computer (PC) or the like. These contents are usually stored as a file on a hard disk which the client PC comprises.
However, the hard disk which the client PC comprises has a small capacity and lack of preventing disk failure, and sometimes files can no longer be utilized due to breakdown of the hard disk.
Hence, there have been a large number of cases where a large-capacity network-connection storage device (NAS) fitted with Redundant Arrays of Inexpensive Disks (RAID) technology is installed and a network is constructed so that files created on a client PC can be saved in this NAS.
In recent years, files created on individual client PCs have widely been managed by aggregating the files in a large-capacity storage device that is connected to a network, for the sake of performing file monitoring for internal regulation of an enterprise or for the purpose of information management catering to electronic disclosure (e-Discovery), and so forth.
Furthermore, the following two investigative methods may be used when investigating how the content of a file saved in a storage device has been appropriated by a third party (when checking how a file that has been leaked outside the company has been used on a file server, for example).
The first investigative method entails seeking a file with the same content by comparing the content of files that have been saved in the storage device.
The second investigative method entails tracking the file access history. An investigation using this second investigative method is executed by making use of the fact that tracking is possible because, when a file is copied, operations such as the copy operation and file name change operation remain in the file access history. A technology which is related to this second investigative method is the technology disclosed in Japanese Unexamined Patent Application No. 2008-52570, for example, which makes it possible to manage a file operation history in a database and detect an object file on the basis of the date and time in order to make it easy to track file name changes and so forth.
However, the first investigative method is confronted by the problem that, due to the number of files saved in the storage device, there is a large number of combinations of files to be compared and it takes considerable effort and time to compare and inspect all of these file combinations.
Further, the second investigative method is faced by the problem that, because associated files are tracked solely based on a change in file name, information which can be tracked in the access history does not remain when the file is copied as content using ‘copy and paste’ and the like. It is therefore difficult to find the appropriation destination file.
In addition, a method that entails installing an agent program to govern the Operating System (OS) of a client PC and successively recording user file operations may also be considered but this makes the task of managing the client PC an enormous one. There is then the risk that the client PC will operate in an unstable manner.